Getting started

This guide is for the administrator or platform team who sets up Cloud Certainty StateCraft. You subscribe on AWS Marketplace, launch one CloudFormation stack in your own AWS account, sign in, look at your first execution, connect your other accounts and give your team access. The installation guide has every detail; this page is the short path.

#What you need

• The AWS account that will run StateCraft (the hub). Subscribe from this account: AWS Marketplace delivers the licence to it through AWS License Manager.
• A supported Region: any Region with AWS Step Functions, AWS Lambda, Amazon API Gateway, Amazon DynamoDB, Amplify Hosting, Amazon Cognito, AWS License Manager and Amazon ECS on Fargate, and, for voice, Amazon Transcribe streaming. The Region of the stack doesn't limit which Regions you can work in.
• Permission to create the stack's resources, including IAM roles with custom names.
• A VPC with at least one subnet that has outbound HTTPS access, for example through a NAT gateway. Only a one-off installer task runs there, for about a minute at install and at each upgrade.
• The email address of your first administrator.
• Your state machines, and a decision on how much StateCraft may do with them: only look (Read), also start, stop and redrive executions (Operate), or also deploy changes (Full).

#1. Subscribe on AWS Marketplace

StateCraft is sold on AWS Marketplace with contract pricing, monthly or for 12 months. There are four plans: Starter, Team, Business and Enterprise. On the StateCraft listing, Team is the base plan and Business and Enterprise are add-ons: for Business choose Team and the Business add-on; for Enterprise choose all three. An add-on bought on its own grants nothing. Starter is a separate listing, StateCraft Starter. See the FAQ for what each plan includes.

1. Sign in to the AWS console with the account that will run StateCraft, as an identity that may subscribe to AWS Marketplace products.
2. Open StateCraft on AWS Marketplace (opens in a new tab), choose Continue to Subscribe, choose the plan and the contract length, and accept the offer.
3. Choose Continue to Configuration, select the fulfilment option and the Region, and continue to the Launch page. Its usage instructions have a link that opens CloudFormation with the release's template already selected.

#2. Launch the stack

Open the launch link from the usage instructions, or this quick-create link with the release version filled in:

https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://cloudcertainty-statecraft-us-east-1.s3.us-east-1.amazonaws.com/pro/<version>/main.yaml&stackName=statecraft

Check the Region in the console's top bar, then set these parameters (everything else can keep its default):

Acknowledge that AWS CloudFormation might create IAM resources with custom names and create the stack. Creation takes about 10 minutes. The template URL is always in the vendor's public bucket in us-east-1, and the same URL works in every Region:

https://cloudcertainty-statecraft-us-east-1.s3.us-east-1.amazonaws.com/pro/<version>/main.yaml

The installation guide has the AWS CLI command and every other parameter, including PassRoleArns for deploys and AssistModelId for assist.

#3. Sign in

• CognitoOnly: the bootstrap administrator receives an email with a temporary password. Every user must register an authenticator app (TOTP MFA is required).
• IAMIdentityCenter or SAML: create a SAML application in your identity provider with the SamlAcsUrl and SamlAudienceUri stack outputs, assign yourself to it, then update the stack and set SamlMetadataUrl to the application's metadata URL. Until then nobody can sign in.
• OIDC: set the OIDC parameters when you create the stack; there is no second step.

Open the PortalUrl stack output and sign in as the bootstrap administrator. That account is always an administrator. Grant the Administrator role to a second person or group under Administration › Roles so you are never locked out.

Screenshot

#4. Look at your first execution

The Fleet page opens with every state machine of the local connection (the hub account) in the Regions you chose, with their executions, success rate and p95 duration over the last 24 hours. Open a state machine, then one of its executions: StateCraft shows the graph with each state's status, the timeline, and the full event history. If you chose Operate or Full, you can start an execution from the state machine page, and redrive a failed one from its page. The user guide explains every page.

To try the designer, open Designer › New draft, pick a template, and say or type a command such as "add a Lambda task called Charge card after Validate order" (with a state of that name in the template). Press Alt+V to talk, or type in the command field.

#5. Add another AWS account

Each other account gets a small role that only your StateCraft stack can assume, with an external ID you choose.

1. In the other account, deploy the spoke role template. Its URL is the hub's SpokeTemplateUrl output. Set TrustedPrincipal to the hub's SpokeTrustedPrincipal output (two role ARNs: copy the whole value), choose an ExternalId of at least 16 characters and an AccessLevel (Operate by default).
2. In StateCraft, open Administration › Connections › Add connection. Enter an id, a name, the account ID, the same access level, the spoke stack's RoleArn output, the same external ID and the Regions.
3. Choose Test. StateCraft assumes the role and counts the state machines in each Region.

For an AWS Organization, deploy the role to every account at once with a StackSet. See Deploy the spoke role in other accounts.

#6. Give your team access

1. Give people a way to sign in. With an identity provider, assign users or groups to the StateCraft application there. With CognitoOnly, create users in the Cognito user pool and mark their email as verified.
2. Grant access. A new user sees no state machines until a grant applies to them. In Administration › Grants, give a user or a group permissions (view, data, run, deploy) on state machine name patterns, for example "the payments group may run orders-*", on one connection or all, in some Regions or all. See the admin guide.
3. Send them the PortalUrl and the user guide.

#Next steps

• Admin guide: roles, connections, grants, voice and assist settings, usage, the audit log and your plan.
• Security overview: for your security review.
• Upgrading: installing new releases.